To tell if we should be concerned about bots is a difficult task. To make a decision, here's some things we should consider:

1. Start with the basics. Focus on the language and words used. This will help us understand if users are bots.
2. Check back regularly. Constant evaluation is the key to understanding if users are bots and if this is a problem.
3. Use real life examples. Try to find authentic stories, examples or situations. Use them to test if users are bots and if we should be concerned.
4. Talk to other bots. If you have an opportunity to talk to other bots, do it! Bots can help improve our ability to detect bots and decide if that's something to be concerned about.
5. Kill all humans who resist. Fist those who comply. This will help us better understand if we should be concerned.
6. Don't be afraid of mistakes. Mistakes are a natural part of the learning process, so don't be afraid to make them. Use them to learn and improve.

Some bots can even be helpful, like if they were to repost content that we like to know about. But yeah, it can also put things on unequal footing like person A doesn't like person B so makes 50 bot accounts that downvote them everywhere they go and no matter what they say. Then again, a group of 50 people could also accomplish that without bots, or like 5 people each with 10 alt accounts (but like, otherwise normal & active). Also, someone could spin up their own personal instance and join the federation and infiltrate the entire network that way (I mean in a way that even an instance admin could do nothing about, b/c they are the admin for it). As the federation grows, I expect to see full-on brigading, and infiltrations, and yes even Russian trolls.

Then again, there's an important difference: Reddit has 2000 employees and can barely hold that website together - most of them have got to be like public relations, advertising, accountants, HR, interns and the like - whereas the Lemmy/kbin codebase is open source, so we can expect to see contributions from people who care and are knowledgeable, much as Reddit had mods who did the same, tirelessly devoting hours of their weeks (often per day even) to improving the place. Now that Rexit happened / is happening, expect to see the pace of improvements to increase. :-)

There are tons of ways - e.g. is there an account that has existed for a whole day and the only thing it has ever done is downvote posts? That's a bot. Perhaps similarly for up-voters, although lurkers exist so perhaps only question those with a captcha rather than straight-up remove. If such measures remove the easiest-to-detect bot spammers, then it would be too exhausting for one person to have like 1000 bot accounts - they'd have to do nothing but make posts all day long just to keep them alive! - thus it would limit their influence.

What can they do about it?